Skip to content

feat(core): add Google One Tap verify API #7417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: yemq-anonymous-google-one-tap-config
Choose a base branch
from

Conversation

darcyYe
Copy link
Contributor

@darcyYe darcyYe commented May 29, 2025

Summary

add Google One Tap verify API, resolves LOG-11507
This API should be able to accept, verify and parse google issued id token, and hence issue Logto OTP for quick sign-in/sign-up.

Testing

Tested with local Google One Tap flow.

Checklist

  • .changeset
  • unit tests
  • integration tests
  • necessary TSDoc comments

@darcyYe darcyYe requested review from a team and Copilot May 29, 2025 08:54
@github-actions github-actions bot added feature Cool stuff size/m labels May 29, 2025
Copy link

github-actions bot commented May 29, 2025

COMPARE TO master

Total Size Diff 📉 -51.63 KB

Diff by File
Name Diff
.changeset/big-games-deny.md 📉 -306 Bytes
.changeset/blue-brooms-clean.md 📉 -352 Bytes
.changeset/dirty-mice-fail.md 📉 -1.23 KB
.changeset/fluffy-actors-knock.md 📉 -351 Bytes
.changeset/funny-eels-wonder.md 📉 -432 Bytes
.changeset/honest-news-rush.md 📉 -757 Bytes
.changeset/large-carrots-think.md 📉 -407 Bytes
.changeset/lemon-walls-fry.md 📉 -600 Bytes
.changeset/moody-turtles-bake.md 📉 -123 Bytes
.changeset/nice-houses-sneeze.md 📉 -2.25 KB
.changeset/perfect-phones-relax.md 📉 -228 Bytes
.changeset/pink-rules-compare.md 📉 -369 Bytes
.changeset/purple-zebras-deliver.md 📉 -609 Bytes
.changeset/red-rules-cheat.md 📉 -70 Bytes
.changeset/soft-eggs-sell.md 📉 -396 Bytes
.changeset/swift-glasses-drive.md 📉 -79 Bytes
.changeset/twenty-buttons-chew.md 📉 -1.9 KB
AWESOME.md 📉 -207 Bytes
README.md 📉 -4 Bytes
package.json 📉 -239 Bytes
packages/cli/CHANGELOG.md 📉 -116 Bytes
packages/cli/package.json 0 Bytes
packages/connectors/connector-qq/CHANGELOG.md 📉 -97 Bytes
packages/connectors/connector-qq/package.json 0 Bytes
packages/connectors/connector-saml/package.json 📉 -1 Bytes
packages/console/CHANGELOG.md 📉 -822 Bytes
packages/console/package.json 📉 -30 Bytes
packages/console/scripts/generate-jwt-customizer-type-definition.ts 📉 -1.57 KB
packages/console/src/assets/docs/guides/web-go/README.mdx 📉 -228 Bytes
packages/console/src/components/MfaFactorName/index.module.scss 📉 -78 Bytes
packages/console/src/components/MfaFactorName/index.tsx 📉 -687 Bytes
packages/console/src/components/MfaFactorTitle/index.tsx 📉 -21 Bytes
packages/console/src/hooks/use-subscribe.ts 📉 -75 Bytes
packages/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/InstructionTab/GuideCard/index.tsx 📉 -40 Bytes
packages/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/InstructionTab/index.tsx 📉 -702 Bytes
packages/console/src/pages/CustomizeJwtDetails/utils/config.tsx 📉 -802 Bytes
packages/console/src/pages/CustomizeJwtDetails/utils/type-definitions.ts 📉 -172 Bytes
packages/console/src/pages/Security/Captcha/CaptchaForm.module.scss 📉 -143 Bytes
packages/console/src/pages/Security/Captcha/CaptchaForm.tsx 📉 -3.99 KB
packages/console/src/pages/Security/Captcha/EnableCaptcha/index.tsx 📉 -371 Bytes
packages/console/src/pages/Security/Captcha/index.module.scss 📉 -112 Bytes
packages/console/src/pages/Security/Captcha/index.tsx 📉 -3.09 KB
packages/core/CHANGELOG.md 📉 -4.7 KB
packages/core/package.json 📉 -1 Bytes
packages/core/src/caches/well-known.ts 📉 -145 Bytes
packages/core/src/env-set/index.ts 📉 -29 Bytes
packages/core/src/event-listeners/index.ts 📉 -722 Bytes
packages/core/src/event-listeners/session.test.ts 📉 -692 Bytes
packages/core/src/event-listeners/session.ts 📉 -297 Bytes
packages/core/src/libraries/session.ts 📉 -2.57 KB
packages/core/src/libraries/user.ts 📉 -82 Bytes
packages/core/src/middleware/koa-audit-log.test.ts 📉 -1.22 KB
packages/core/src/middleware/koa-audit-log.ts 📉 -375 Bytes
packages/core/src/middleware/koa-cors.ts 📉 -2.84 KB
packages/core/src/middleware/koa-logto-anonymous-cors.test.ts 📉 -6.5 KB
packages/core/src/middleware/koa-logto-anonymous-cors.ts 📉 -4.12 KB
packages/core/src/middleware/koa-slonik-error-handler.ts 📉 -426 Bytes
packages/core/src/oidc/extra-token-claims.ts 📉 -1.26 KB
packages/core/src/queries/account-center.ts 📉 -344 Bytes
packages/core/src/queries/oidc-session-extensions.ts 📉 -1.29 KB
packages/core/src/routes/account-center/index.openapi.json 📉 -138 Bytes
packages/core/src/routes/account-center/index.ts 📉 -313 Bytes
packages/core/src/routes/account/email-and-phone.ts 0 Bytes
packages/core/src/routes/account/identities.ts 0 Bytes
packages/core/src/routes/account/index.openapi.json 📉 -3.01 KB
packages/core/src/routes/account/index.ts 📉 -96 Bytes
packages/core/src/routes/account/mfa-verifications.ts 📉 -6.64 KB
packages/core/src/routes/experience/classes/experience-interaction.ts 📉 -744 Bytes
packages/core/src/routes/experience/classes/verifications/backup-code-verification.ts 📉 -436 Bytes
packages/core/src/routes/experience/classes/verifications/code-verification.ts 📉 -1.14 KB
packages/core/src/routes/experience/classes/verifications/enterprise-sso-verification.ts 📉 -600 Bytes
packages/core/src/routes/experience/classes/verifications/index.ts 0 Bytes
packages/core/src/routes/experience/classes/verifications/new-password-identity-verification.ts 📉 -766 Bytes
packages/core/src/routes/experience/classes/verifications/one-time-token-verification.ts 📉 -557 Bytes
packages/core/src/routes/experience/classes/verifications/password-verification.ts 📉 -373 Bytes
packages/core/src/routes/experience/classes/verifications/social-verification.ts 📉 -617 Bytes
packages/core/src/routes/experience/classes/verifications/totp-verification.ts 📉 -377 Bytes
packages/core/src/routes/experience/classes/verifications/web-authn-verification.ts 📉 -699 Bytes
packages/core/src/routes/experience/types.ts 📉 -1.04 KB
packages/core/src/routes/experience/verification-routes/web-authn-verification.ts 📉 -21 Bytes
packages/core/src/routes/google-one-tap/index.openapi.json 📉 -3.46 KB
packages/core/src/routes/google-one-tap/index.ts 📉 -5 KB
packages/core/src/routes/init.ts 📉 -276 Bytes
packages/core/src/routes/interaction/additional.ts 📉 -71 Bytes
packages/core/src/routes/interaction/utils/webauthn.test.ts 📉 -4 Bytes
packages/core/src/routes/interaction/utils/webauthn.ts 📉 -319 Bytes
packages/core/src/routes/interaction/verifications/mfa-payload-verification.ts 📉 -15 Bytes
packages/core/src/routes/public-wellknown.ts 📉 -1.19 KB
packages/core/src/routes/swagger/utils/documents.ts 📉 -140 Bytes
packages/core/src/routes/swagger/utils/general.ts 📉 -100 Bytes
packages/core/src/routes/swagger/utils/operation-id.ts 📉 -118 Bytes
packages/core/src/routes/verification/index.openapi.json 📉 -1.73 KB
packages/core/src/routes/verification/index.ts 📉 -2.42 KB
packages/core/src/sso/AzureOidcSsoConnector/index.ts 📉 -221 Bytes
packages/core/src/sso/types/saml.ts 📉 -125 Bytes
packages/core/src/tenants/Queries.ts 📉 -178 Bytes
packages/core/src/tenants/Tenant.ts 📉 -142 Bytes
packages/core/src/utils/user.ts 📉 -12 Bytes
packages/core/src/utils/zod.ts 📉 -662 Bytes
packages/create/CHANGELOG.md 📉 -51 Bytes
packages/create/package.json 0 Bytes
packages/experience/CHANGELOG.md 📉 -288 Bytes
packages/experience/package.json 0 Bytes
packages/integration-tests/CHANGELOG.md 📉 -212 Bytes
packages/integration-tests/package.json 📉 -92 Bytes
packages/integration-tests/src/mocks/jwt-customizer.ts 📉 -728 Bytes
packages/integration-tests/src/api/verification-record.ts 📉 -691 Bytes
packages/integration-tests/src/helpers/index.ts 📉 -1 Bytes
packages/integration-tests/src/helpers/sign-in-experience.ts 📉 -209 Bytes
packages/integration-tests/src/tests/api/account-center.test.ts 📉 -55 Bytes
packages/integration-tests/src/tests/api/account/account-center-reject.test.ts 0 Bytes
packages/integration-tests/src/tests/api/account/mfa.test.ts 📉 -3.04 KB
packages/integration-tests/src/tests/api/experience-api/sign-in-interaction/enterprise-sso.test.ts 📉 -134 Bytes
packages/integration-tests/src/tests/api/google-one-tap.test.ts 📉 -3.8 KB
packages/integration-tests/src/tests/api/oidc/get-access-token.test.ts 📉 -432 Bytes
packages/integration-tests/src/tests/api/oidc/token-exchange/personal-access-token.test.ts 📉 -1 KB
packages/integration-tests/src/tests/well-known/index.test.ts 📉 -279 Bytes
packages/phrases/src/locales/ar/errors/account-center.ts 📉 -54 Bytes
packages/phrases/src/locales/ar/errors/custom-profile-fields.ts 📉 -813 Bytes
packages/phrases/src/locales/ar/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/ar/translation/admin-console/jwt-claims.ts 📉 -335 Bytes
packages/phrases/src/locales/de/errors/account-center.ts 📉 -50 Bytes
packages/phrases/src/locales/de/errors/custom-profile-fields.ts 📉 -638 Bytes
packages/phrases/src/locales/de/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/de/translation/admin-console/jwt-claims.ts 📉 -313 Bytes
packages/phrases/src/locales/en/errors/account-center.ts 📉 -46 Bytes
packages/phrases/src/locales/en/errors/custom-profile-fields.ts 📉 -564 Bytes
packages/phrases/src/locales/en/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/en/errors/session.ts 📉 -118 Bytes
packages/phrases/src/locales/en/translation/admin-console/jwt-claims.ts 📉 -277 Bytes
packages/phrases/src/locales/es/errors/account-center.ts 📉 -54 Bytes
packages/phrases/src/locales/es/errors/custom-profile-fields.ts 📉 -692 Bytes
packages/phrases/src/locales/es/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/es/translation/admin-console/jwt-claims.ts 📉 -306 Bytes
packages/phrases/src/locales/fr/errors/account-center.ts 📉 -52 Bytes
packages/phrases/src/locales/fr/errors/custom-profile-fields.ts 📉 -630 Bytes
packages/phrases/src/locales/fr/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/fr/translation/admin-console/jwt-claims.ts 📉 -315 Bytes
packages/phrases/src/locales/it/errors/account-center.ts 📉 -51 Bytes
packages/phrases/src/locales/it/errors/custom-profile-fields.ts 📉 -628 Bytes
packages/phrases/src/locales/it/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/it/translation/admin-console/jwt-claims.ts 📉 -299 Bytes
packages/phrases/src/locales/ja/errors/account-center.ts 📉 -76 Bytes
packages/phrases/src/locales/ja/errors/custom-profile-fields.ts 📉 -742 Bytes
packages/phrases/src/locales/ja/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/ja/translation/admin-console/jwt-claims.ts 📉 -377 Bytes
packages/phrases/src/locales/ko/errors/account-center.ts 📉 -67 Bytes
packages/phrases/src/locales/ko/errors/custom-profile-fields.ts 📉 -742 Bytes
packages/phrases/src/locales/ko/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/ko/translation/admin-console/jwt-claims.ts 📉 -327 Bytes
packages/phrases/src/locales/pl-pl/errors/account-center.ts 📉 -50 Bytes
packages/phrases/src/locales/pl-pl/errors/custom-profile-fields.ts 📉 -674 Bytes
packages/phrases/src/locales/pl-pl/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/pl-pl/translation/admin-console/jwt-claims.ts 📉 -298 Bytes
packages/phrases/src/locales/pt-br/errors/account-center.ts 📉 -52 Bytes
packages/phrases/src/locales/pt-br/errors/custom-profile-fields.ts 📉 -642 Bytes
packages/phrases/src/locales/pt-br/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/pt-br/translation/admin-console/jwt-claims.ts 📉 -291 Bytes
packages/phrases/src/locales/pt-pt/errors/account-center.ts 📉 -55 Bytes
packages/phrases/src/locales/pt-pt/errors/custom-profile-fields.ts 📉 -667 Bytes
packages/phrases/src/locales/pt-pt/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/pt-pt/translation/admin-console/jwt-claims.ts 📉 -299 Bytes
packages/phrases/src/locales/ru/errors/account-center.ts 📉 -56 Bytes
packages/phrases/src/locales/ru/errors/custom-profile-fields.ts 📉 -854 Bytes
packages/phrases/src/locales/ru/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/ru/translation/admin-console/jwt-claims.ts 📉 -431 Bytes
packages/phrases/src/locales/tr-tr/errors/account-center.ts 📉 -43 Bytes
packages/phrases/src/locales/tr-tr/errors/custom-profile-fields.ts 📉 -608 Bytes
packages/phrases/src/locales/tr-tr/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/tr-tr/translation/admin-console/jwt-claims.ts 📉 -298 Bytes
packages/phrases/src/locales/zh-cn/errors/account-center.ts 📉 -43 Bytes
packages/phrases/src/locales/zh-cn/errors/custom-profile-fields.ts 📉 -560 Bytes
packages/phrases/src/locales/zh-cn/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/zh-cn/translation/admin-console/jwt-claims.ts 📉 -247 Bytes
packages/phrases/src/locales/zh-hk/errors/account-center.ts 📉 -43 Bytes
packages/phrases/src/locales/zh-hk/errors/custom-profile-fields.ts 📉 -563 Bytes
packages/phrases/src/locales/zh-hk/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/zh-hk/translation/admin-console/jwt-claims.ts 📉 -241 Bytes
packages/phrases/src/locales/zh-tw/errors/account-center.ts 📉 -43 Bytes
packages/phrases/src/locales/zh-tw/errors/custom-profile-fields.ts 📉 -572 Bytes
packages/phrases/src/locales/zh-tw/errors/index.ts 📉 -89 Bytes
packages/phrases/src/locales/zh-tw/translation/admin-console/jwt-claims.ts 📉 -247 Bytes
packages/schemas/CHANGELOG.md 📉 -90 Bytes
packages/schemas/alterations/1.28.0-1745735646-add-email-blocklist-policy-column-to-sie-table.ts 📉 -508 Bytes
packages/schemas/alterations/next-1745735646-add-email-blocklist-policy-column-to-sie-table.ts 📉 -508 Bytes
packages/schemas/alterations/next-1748832174-add-webauthn-related-origins.ts 📉 -504 Bytes
packages/schemas/alterations/next-1749005587-user-sso-identities-table-add-updated-at-column.ts 📉 -759 Bytes
packages/schemas/alterations/next-1749026308-add-oidc-session-extension-table.ts 📉 -1.26 KB
packages/schemas/alterations/next-1749523818-add-custom-profile-fields.ts 📉 -2.11 KB
packages/schemas/package.json 0 Bytes
packages/schemas/src/foundations/jsonb-types/account-centers.ts 📉 -198 Bytes
packages/schemas/src/foundations/jsonb-types/custom-profile-fields.ts 📉 -1.36 KB
packages/schemas/src/foundations/jsonb-types/index.ts 📉 -1 Bytes
packages/schemas/src/foundations/jsonb-types/users.ts 📉 -158 Bytes
packages/schemas/src/foundations/jsonb-types/verification-records.ts 📉 -463 Bytes
packages/schemas/src/types/custom-profile-fields.ts 📉 -6.21 KB
packages/schemas/src/types/index.ts 📉 -93 Bytes
packages/schemas/src/types/interactions.ts 📉 -31 Bytes
packages/schemas/src/types/log/interaction.ts 📉 -51 Bytes
packages/schemas/src/types/logto-config/jwt-customizer.ts 📉 -2.92 KB
packages/schemas/src/types/sso-connector.ts 📉 -277 Bytes
packages/schemas/src/types/user.ts 📉 -33 Bytes
packages/schemas/src/types/verification-records/backup-code-verification.ts 📉 -652 Bytes
packages/schemas/src/types/verification-records/code-verification.ts 📉 -1.84 KB
packages/schemas/src/types/verification-records/enterprise-sso-verification.ts 📉 -937 Bytes
packages/schemas/src/types/verification-records/index.ts 📉 -772 Bytes
packages/schemas/src/types/verification-records/new-password-identity-verification.ts 📉 -1.26 KB
packages/schemas/src/types/verification-records/one-time-token-verification.ts 📉 -944 Bytes
packages/schemas/src/types/verification-records/password-verification.ts 📉 -648 Bytes
packages/schemas/src/types/verification-records/social-verification.ts 📉 -984 Bytes
packages/schemas/src/types/verification-records/totp-verification.ts 📉 -606 Bytes
packages/schemas/src/types/verification-records/verification-type.ts 📉 -463 Bytes
packages/schemas/src/types/verification-records/web-authn-verification.ts 📉 -1.01 KB
packages/schemas/tables/account_centers.sql 📉 -97 Bytes
packages/schemas/tables/custom_profile_fields.sql 📉 -1.19 KB
packages/schemas/tables/oidc_model_instances.sql 📉 -22 Bytes
packages/schemas/tables/oidc_session_extensions.sql 📉 -638 Bytes
packages/schemas/tables/user_sso_identities.sql 📉 -245 Bytes
packages/shared/CHANGELOG.md 📉 -211 Bytes
packages/shared/package.json 0 Bytes
packages/toolkit/connector-kit/src/types/social.ts 📉 -524 Bytes
packages/translate/CHANGELOG.md 📉 -608 Bytes
packages/translate/package.json 0 Bytes
packages/tunnel/CHANGELOG.md 📉 -89 Bytes
packages/tunnel/package.json 0 Bytes
pnpm-lock.yaml 📉 -4.99 KB

Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Adds a new endpoint to verify Google One Tap ID tokens and generate magic links for authentication.

  • Introduces /google-one-tap/verify POST route with CORS handling, token verification, and magic link generation.
  • Updates OpenAPI spec with request/response schemas for the new endpoint.
  • Leverages JOSE for JWT verification, date-fns for expiration, and shared utilities for ID/secret generation.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
packages/core/src/routes/google-one-tap/index.ts Implements Google One Tap verify route, CORS logic, and magic link creation
packages/core/src/routes/google-one-tap/index.openapi.json Adds OpenAPI definitions for the new /api/google-one-tap/verify endpoint
Comments suppressed due to low confidence (3)

packages/core/src/routes/google-one-tap/index.ts:19

  • Constant names should use UPPER_SNAKE_CASE to distinguish them from variables. Consider renaming defaultExpiresTime to DEFAULT_EXPIRES_TIME.
const defaultExpiresTime = 10 * 60;

packages/core/src/routes/google-one-tap/index.ts:22

  • [nitpick] For consistency with other constants, rename googleJwksUri to GOOGLE_JWKS_URI and consider grouping it with other top-level constants.
const googleJwksUri = 'https://www.googleapis.com/oauth2/v3/certs';

packages/core/src/routes/google-one-tap/index.ts:122

  • This new /google-one-tap/verify route contains substantial logic (CORS, JWT verification, database operations) but no explicit tests were added. Please add unit and integration tests to cover success, error, and CORS scenarios.
router.post(

@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch from 415268a to ae43264 Compare May 29, 2025 09:08
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch 2 times, most recently from c0ef220 to 4a4511d Compare June 3, 2025 02:58
@darcyYe darcyYe marked this pull request as ready for review June 3, 2025 02:59
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch from 4a4511d to f2a751b Compare June 16, 2025 03:35
@darcyYe darcyYe force-pushed the yemq-anonymous-google-one-tap-config branch from 10bef09 to 2bc5653 Compare June 16, 2025 03:43
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch 2 times, most recently from 6a6524e to 05766af Compare June 16, 2025 03:53
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch from 05766af to 52c5cf2 Compare June 16, 2025 04:51
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch from d4fbe2c to 0afc219 Compare June 16, 2025 07:11
@darcyYe darcyYe force-pushed the yemq-add-google-one-tap-verify-api branch from 0afc219 to db820b7 Compare June 16, 2025 16:37
Copy link
Contributor

@simeng-li simeng-li Jun 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rename the middleware, and the routes will no longer be anonymous, or something like Logto anonymous.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

3 participants